Keep AI review gate on trusted scripts

Author: Mikhail Orlov

.github/workflows/ai-review.yml

@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - name: Checkout gate scripts
+      - name: Checkout trusted gate scripts
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.sha || github.event.repository.default_branch }}
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Check trusted gate script availability
         id: gate_scripts
@@ -58,7 +58,7 @@ jobs:
       - name: Bootstrap compatibility notice
         if: steps.gate_scripts.outputs.available != 'true'
         run: |
-          echo "::notice::Skipping AI review gate because gate scripts are not yet present on the selected checkout ref: ${{ steps.gate_scripts.outputs.missing }}."
+          echo "::notice::Skipping AI review gate because trusted scripts are not yet present on default branch: ${{ steps.gate_scripts.outputs.missing }}."
           echo "::notice::This is expected for the first bootstrap PR. After merge, AI Review runs normally."
 
       - name: Resolve PR context

docs_project/project/devops/ai-pr-workflow.md

@@ -10,7 +10,7 @@ The `AI Review` workflow validates the configured native review backend from the
 
 If `AI_REVIEW_GITHUB_TOKEN` is configured as a repository Actions secret, the workflow uses it for review-gate API calls; otherwise it falls back to the built-in `github.token`.
 
-Same-repository pull request runs use gate scripts from the pull request head SHA, so changes to the review gate can be validated before merge. Fork and manual validation runs use the default branch gate scripts.
+The required gate executes scripts from the default branch so review validation is not controlled by pull request code.
 
 Before merge, the author should also confirm the SENAR done gate:
 

specs/002-main-branch-protection/plan.md

@@ -38,7 +38,6 @@ No new abstraction is added; the existing config list is extended with the missi
 | AC-004 | `tests/ai-review-workflow.test.mjs` verifies trigger comment permission denial is handled with an explicit degraded-mode warning. |
 | AC-005 | `tests/ai-review-workflow.test.mjs` verifies the workflow uses `secrets.AI_REVIEW_GITHUB_TOKEN` before falling back to `github.token`. |
 | AC-006 | `tests/ai-review-workflow.test.mjs` verifies resolved Codex review threads are filtered out before review evidence classification. |
-| AC-007 | `tests/ai-review-workflow.test.mjs` verifies same-repository pull request runs checkout gate scripts from the pull request head SHA. |
 
 Negative scenario evidence:
 

specs/002-main-branch-protection/spec.md

@@ -32,7 +32,6 @@ As a repository maintainer, I want `main` protected by a PR-only workflow, so th
 4. Given the `AI Review` workflow token cannot write issue comments, when the trigger comment cannot be posted, then the gate logs the permission limitation and waits for existing or human-triggered review evidence instead of crashing with a stack trace.
 5. Given `AI_REVIEW_GITHUB_TOKEN` is configured as a repository Actions secret, when `AI Review` runs, then review-gate API calls use that token instead of the built-in `github.token`.
 6. Given a blocking Codex review thread has been resolved, when `AI Review` evaluates review evidence, then the resolved comment is not treated as an active blocker.
-7. Given the `AI Review` gate itself changes in a same-repository pull request, when the required check runs, then it validates using the pull request head gate scripts instead of stale default-branch scripts.
 
 ## Negative Scenarios
 
@@ -47,7 +46,6 @@ As a repository maintainer, I want `main` protected by a PR-only workflow, so th
 - FR-005: Trigger comment permission denial must be handled as an explicit degraded mode, not as an uncaught script exception.
 - FR-006: The `AI Review` workflow must support an `AI_REVIEW_GITHUB_TOKEN` repository secret override for review-gate API calls.
 - FR-007: Resolved Codex review threads must not count as active blocking review evidence.
-- FR-008: Same-repository pull request `AI Review` runs must use gate scripts from the pull request head SHA so gate changes are testable before merge.
 
 ## Success Criteria
 

specs/002-main-branch-protection/tasks.md

@@ -15,7 +15,6 @@
 - [x] T011 Handle trigger comment permission denial without an uncaught exception.
 - [x] T012 Add `AI_REVIEW_GITHUB_TOKEN` secret override for review-gate API calls.
 - [x] T013 Ignore resolved Codex review threads when classifying active review evidence.
-- [x] T014 Use same-repository pull request head gate scripts for `AI Review` validation.
 - [x] T015 Require `AI_REVIEW_GITHUB_TOKEN` before automatic review trigger comments.
 
 ## Verification
@@ -29,6 +28,7 @@
 ### Dead Ends
 
 - Direct GitHub branch protection and repository ruleset API calls returned HTTP 403 because this private repository does not currently have branch protection available on its GitHub plan.
+- Checking out same-repository pull request head gate scripts for the required `AI Review` job was rejected by Codex review as a P1 security issue because PR-controlled scripts would run with `GITHUB_TOKEN`/`AI_REVIEW_GITHUB_TOKEN`.
 
 ### Decisions
 
@@ -38,7 +38,7 @@
 - Restricted automatic pull request trigger comments to same-repository PRs and treated 403 token write denial as a degraded mode that waits for existing or human-triggered review evidence.
 - Added `AI_REVIEW_GITHUB_TOKEN` as the repository secret override because the built-in GitHub Actions integration token can still be denied when posting native review trigger comments.
 - Resolved Codex review threads are filtered through GitHub GraphQL before classifying active REST review comments, because the REST pull-request comments endpoint does not expose thread resolved state.
-- Same-repository pull request `AI Review` runs checkout gate scripts from the pull request head SHA so fixes to the gate can satisfy the required check before the PR merges; fork and manual validation runs keep using default-branch gate scripts.
+- The required `AI Review` gate continues to execute default-branch scripts so review validation is not controlled by pull request code.
 - Automatic pull request review trigger comments require `AI_REVIEW_GITHUB_TOKEN` so command comments are authored by a trusted account instead of `github-actions[bot]`, which this repository's AI command policy rejects.
 
 ### Known Issues
@@ -51,5 +51,5 @@
 - `pnpm run preflight` passed:
   - feature-memory gate success for `specs/002-main-branch-protection/`
   - repository baseline check success
-- `pnpm run test` passed with 12/12 tests, including same-repository pull request AI Review trigger-mode coverage, same-repository head checkout coverage, trigger-comment permission-denial handling, `AI_REVIEW_GITHUB_TOKEN` fallback coverage, and resolved Codex thread filtering.
+- `pnpm run test` passed with 12/12 tests, including same-repository pull request AI Review trigger-mode coverage, trusted default-branch checkout coverage, trigger-comment permission-denial handling, `AI_REVIEW_GITHUB_TOKEN` fallback coverage, and resolved Codex thread filtering.
 - `git diff --check` passed with no whitespace errors.

tests/ai-review-workflow.test.mjs

@@ -6,10 +6,7 @@ const workflow = readFileSync(new URL("../.github/workflows/ai-review.yml", impo
 const gate = readFileSync(new URL("../scripts/ai-review-gate.mjs", import.meta.url), "utf8");
 
 test("same-repository pull request AI Review runs trigger the selected backend before polling", () => {
-  assert.match(
-    workflow,
-    /ref:\s*\$\{\{\s*github\.event_name == 'pull_request' && github\.event\.pull_request\.head\.repo\.full_name == github\.repository && github\.event\.pull_request\.head\.sha \|\| github\.event\.repository\.default_branch\s*\}\}/
-  );
+  assert.match(workflow, /ref:\s*\$\{\{\s*github\.event\.repository\.default_branch\s*\}\}/);
   assert.match(workflow, /EVENT_NAME:\s*\$\{\{\s*github\.event_name\s*\}\}/);
   assert.match(workflow, /GITHUB_TOKEN:\s*\$\{\{\s*secrets\.AI_REVIEW_GITHUB_TOKEN\s*\|\|\s*github\.token\s*\}\}/);
   assert.match(workflow, /HAS_AI_REVIEW_GITHUB_TOKEN:\s*\$\{\{\s*secrets\.AI_REVIEW_GITHUB_TOKEN != ''\s*\}\}/);